EP2688327A2 - Activation of subscriber identity data - Google Patents

Abstract

The method involves receiving status data (5) with respect to participant identity data (4) of a participant identity module i.e. subscriber identity module (SIM) cards (2a-2c), in another participant identity module over a communication channel (9) between the modules. A status in the status data in the latter module of an inactive status is changed to an active status. The identity data is activated in the latter module from point of time of status change. Mobile terminals (1a, 1b) are justified for service utilization of a communication network by utilizing the activated identity data. The mobile terminals are designed as mobile telephones, motor car telephones, private telephones, smart phones, tablet personal computers (PCs), notebooks and personal digital assistants (PDAs). Independent claims are also included for the following: (1) a participant identity module for a terminal (2) a system for activating participant identity data in a participant identity module for unique identifying of a participant in a communication network.

Description

The invention relates to a method, a system and a subscriber identity module for activating subscriber identity data. \

Subscriber identity data serves to uniquely identify and / or authenticate a subscriber in a communication network, for example a digital mobile radio network. By means of this subscriber identity data, it is possible for an operator of a communication network to unambiguously assign the use of a service offered by the network operator, for example a voice and / or data service, to each subscriber in the communication network. Furthermore, it is possible for the operator to enable network access, ie the entry into the communication network, as soon as an authentication of the subscriber has taken place or to refuse the network access as soon as an authentication of the subscriber is not possible.

These subscriber identity data reside in a subscriber identity module, also referred to as Subscriber Identity Module (SIM). Usually, each terminal is equipped with such a subscriber identity module to use services of the communication network can.

If a subscriber subscribes to a communication network, it is determined by means of the subscriber identity data whether the subscriber is properly activated in the communication network and which services the subscriber is allowed to use in the network. An unidentifiable or authenticated subscriber is not authorized to use the services and will be rejected by the network.

Nowadays, it is common for a subscriber on a network to have a plurality of terminals for using services of a communication network. It may, for example, be the wish of a subscriber to switch between several terminals, for example a company mobile telephone, a motor vehicle telephone and private telephone. Alternatively, it may be the subscriber's desire to allow a terminal access to use services of the network, such as updating firmware, obtaining multimedia data, and the like.

Since the use of each terminal in a network has the consequence that the terminal has to have a subscriber identity module with unique subscriber identity data, the subscriber must use in a first variant according to the plurality of terminals also a corresponding plurality of subscriber identity modules, the subscriber itself and also managed by the network operator. Depending on the operator, this leads to higher costs and additional expenses.

In a second variant, the subscriber can also remove a subscriber identity module from a first terminal and insert it into a second terminal at every change request. This variant is very uncomfortable, for example, terminals must be opened awkward to bring in or remove the subscriber identity module. A flexible use of the two terminals is thus excluded. The problem becomes all the more acute if the SIM is a hard-wired module.

Systems are known from the prior art, which allow to introduce a plurality of subscriber identity data in a subscriber identity module, for example, the use of services of a communication network for private purposes to be distinguished from the use of the services of the same communication network for business purposes and to be recorded accordingly. Such systems are referred to as dual IMSI systems. These systems increase the administrative burden, since multiple subscriber identity data must be generated for a terminal and the same communication network, resulting in additional costs.

In the EP 0 669 774 B1 It is proposed to use identical subscriber identity modules, so-called SIM clones. Each SIM clone has identical subscriber identity data. Each SIM clone is inserted in a terminal. Simultaneous log-in of multiple terminals is prevented by a network operator-side verification method, the terminal is entitled to use services only if not already another terminal with identical subscriber identity data is booked for the benefit of services in the network. On the one hand, the subscriber requires network availability in order to authorize the terminal to operate in the network, on the other hand, a wrongly logged-in terminal blocks the log-in of a second terminal, whereby the subscriber can not entitle the second terminal to use the services of the network.

The invention is therefore based on the object of providing a method in which a subscriber can use more terminals for the use of services in a communication network in a more flexible, cost-effective and simpler manner.

The object of the invention is achieved by the measures described in the independent independent claims. Advantageous embodiments are described in the respective dependent claims. The object is achieved in particular by a method for activating subscriber identity data in a first subscriber identity module for a first terminal for uniquely identifying a subscriber in a communication network. The method comprises the following method steps: receiving status data relating to subscriber identity data of a second subscriber identity module in the first subscriber identity module via a communication channel between the first subscriber identity module and the second subscriber identity module; and changing a status in the status data in the first subscriber identity module from an inactive status to an active status, wherein from the time of the status change, the subscriber identity data in the first subscriber identity module is activated, thereby authorizing the first terminal to utilize services over the communication network using the activated subscriber identity data becomes.

A terminal in the sense of the invention is, in principle, a device or a device component which has means for communication with the communication network in order to be able to use services of the communication network. For example, a mobile device such as a smart phone, a tablet PC, a notebook, a PDA is to be understood. By way of example, the terminal can also be understood to mean multimedia terminals such as digital picture frames, audio devices, television sets, e-book readers, which likewise have means for communication with the communication network. For example, the term terminals also includes any type of machines, vending machines, vehicles, devices that have means, in particular mobile radio modems, for communicating with the communication network.

In a subscriber identity module in the context of the invention is a reduced in size and scope of resources module having a microcontroller and at least one data interface for communication with a terminal. This subscriber identity module has a secure memory area in that the subscriber identity data are securely introduced in order to prevent manipulation and / or misuse attempts when identifying and / or authenticating to the network. The subscriber identity module is operable by means of the terminal.

The subscriber identity module is, for example, a chip card, also known as a universal integrated circuit card (UICC) or SIM card, in a mobile radio network with machine-readable subscriber identification data of the subscriber stored on a chip. Such subscriber identification modules are operated by means of card reading units in a terminal and are in particular intended to be removed from the terminal for the purpose of exchange or use in a second terminal.

Alternatively, the subscriber identity module is an integral part of the terminal, such as a hardwired electronic module. Such subscriber identity modules are also referred to as embedded UICC (eUICC). In this design, these subscriber identity modules are not intended for removal from the terminal and can not be easily replaced in principle. Such subscriber identity modules can also be designed as embedded secure elements, ie as a secure hardware component in the terminal.

Alternatively, the subscriber identity module is a machine-to-machine, or M2M, module. These modules are used for remote monitoring, control and maintenance of end devices such as machines, systems and systems. Alternatively, they can also be used for counting units such as electricity meters, hot water meters.

Alternatively, the subscriber identity module is designed as a software component in a trustworthy part of an operating system, a so-called trusted execution environment (TEE) of the terminal. The subscriber identity module is then designed, for example, within a secure runtime environment in the form of programs running in it, so-called trustlets.

Subscriber identity data in the sense of the invention are, on the one hand, data which uniquely identifies a subscriber in the communication network, for example an International Mobile Subscriber Identity (IMSI) and / or subscriber-specific data. On the other hand, the subscriber identity data can be data that uniquely authenticate a subscriber on the communication network, for example an authentication algorithm, specific algorithm parameters, a cryptographic authentication key or a cryptographic over-the-air (OTA) key.

A participant in the sense of the invention is, for example, a person who wishes to access services of the communication network by means of the terminal. A subscriber is also to be understood as a terminal in an M2M environment.

A communication network in the sense of the invention is a technical device on which the transmission of signals under identification and / or authentication of the communication subscriber takes place, whereby services are offered. In particular, for example, the "Global System for Mobile Communications", short GSM as a second generation representative or the "General Packet Radio Service", short GPRS or "Universal Mobile Telecommunications System", briefly UMTS as a third generation or the "Long Term Evolution ", LTE for short, understood as a fourth generation mobile network.

A service in the sense of the invention is in particular a voice service or a data service, with which information and / or data are transmitted via the communication network.

As a channel, a real transmission path between the first and the second terminal is understood, wherein the communication medium is formed contactless and / or contact-related. In particular, the channel is formed only in the physical layer and / or the link layer of the OSI reference model.

The channel is preferably a local direct contactless communication channel between the first and second terminals, for example near field communication interfaces according to one of ISO / IEC 14443, ISO / IEC 15693, ISO / IEC 18092; for example, Bluetooth according to IEEE 802.15.1; a direct local radio network, WLAN for short according to IEEE 802.11; an infrared transmission and / or wireless USB according to ISO / IEC 26907.

The channel is alternatively a local direct wired communication channel between the first and second terminals, for example by means of serial data transmission in accordance with USB, Firewire.

Alternatively, the channel is a local communication channel formed according to the Bearer Independent Protocol, GDP for short, or a communication channel via a mobile radio network. The channel is alternatively formed by the use of SMS. This physically requires the establishment of a communication path to a remote mobile station, but the method according to the invention nevertheless runs logically exclusively between the first subscriber identity module and the second subscriber identity module.

According to the invention, the status of the subscriber identity data is changed from an inactive status to an active status after status data regarding subscriber identity data has been received by the second terminal. Thus, advantageously, a subscriber identity module is only successfully authenticated in the network from the time the subscriber identity data is activated and is entitled to use the services of the network. The first terminal thus receives the right to successful identification / authentication on the network by receiving the status data from the second terminal.

In one variant of the invention, an authentication on the network is prevented by the subscriber identity module or the terminal if there is an inactive status of the subscriber identity data. Because the checking of the status within the subscriber identity module takes place, the method can not be manipulated.

In a second variant, the network queries the status of the subscriber identity data of the subscriber identity module during the authentication attempt of the respective terminal and entitles the user to active status and denies the use of services in the inactive status.

In particular, the subscriber identity data in the first subscriber identity module and the subscriber identity data in the second subscriber identity module are identical. The subscriber identity modules are designed in particular as SIM clones. The status data of the subscriber identity data differ at least in that only one of all terminals involved in the inventive method has activated subscriber identity data. As a result, the subscriber identity modules are generated in a simple manner, or the data for the respective module can be easily generated, wherein the use of services is only possible from one terminal. An involvement of the network operator, in particular the monitoring of an already registered SIM clone can be omitted. A simultaneous use of services by two terminals with identical subscriber identity data is thus reliably prevented. A subscriber is thereby enabled to operate a plurality of terminals as he pleases, the right to use a terminal being transmitted directly by another terminal.

In particular, before receiving the status data of the second subscriber identity module in the first subscriber identity module, the second terminal is authorized to use services via the communication network using subscriber identity data in the second subscriber identity module. Thus, virtually the right to use services of the network from the second terminal is transmitted to the first terminal. The terminals set up a channel and give each other the right to use the services.

In particular, prior to receiving the status data of the second subscriber identity module, a status of the status data of the second subscriber identity module is changed from an active status to an inactive status, wherein from the time of the status change in the second subscriber identity module, the subscriber identity data are deactivated, whereby the second terminal is no longer authorized to use services over the communication network. Thus, a subscriber may, as desired, activate the first terminal to use the services, previously disabling a second terminal for use.

In an advantageous embodiment of the invention, the change of status in the status data of the first subscriber identity module is sent as an acknowledgment to the second subscriber identity module. As a result, a return channel is formed in the method, whereby the second terminal is informed about the successful activation of the first subscriber identity module. In particular, the confirmation may be coupled to a predefined period of time, so that if the confirmation is not sent, the network is informed.

In one embodiment of the invention, before the transmission of the status data of the second subscriber identity module by the second subscriber identity module, identification data of the first subscriber identity module including an identifier of the first subscriber identity module are introduced into the status data. In this case, the identification data are introduced into a data field of identification data of the second subscriber identity module. Thus, it is logged to which subscriber identity module in the system, the status data has been transmitted, so that in case of incorrect entry of the first subscriber identity module and / or a failure to acknowledge receipt of the status data in the second subscriber identity module, the status data can be sent again to the first subscriber identity module. Thus, in case of a faulty termination of the process reproducible to which subscriber identity module the status data has been sent.

According to the invention, an identifier is an identification of the subscriber identity module that is unique in the system. The identifier is different from the subscriber identity data. The identifier can be a number of the subscriber identity module which is unique for the entire communication network, for example an Integrated Chip Card Identification, or ICCID for short. Alternatively, the number can be a unique number for all subscriber identity modules involved in the method or system according to the invention. Each additional terminal added for the procedure receives an increment of the last number assigned. This makes each module clearly identifiable in the process.

In an advantageous embodiment, before receiving the status data of the second subscriber identity module in the first subscriber identity module, identification data from the second subscriber identity module to the first subscriber identity module including an identifier of the second subscriber identity module and an identifier of the first subscriber identity module are transmitted. The first subscriber identity module confirms the received identifier data. Thereafter, the status in the status data of the second subscriber identity module is changed from an active status to an inactive status. From the time of the status change in the second subscriber identity module, the subscriber identity data is deactivated, whereby the second terminal for the use of services over the communication network is unauthorized.

This refinement has the advantage that the second module only changes state upon correct confirmation of the identification data. The subscriber identity module has data fields for identification data of at least two subscriber identity modules. Manipulation attempts are effectively prevented in this way. In addition, there is an effective logging of the status change both in the first module and in the second module. If, unexpectedly, the communication channel is disturbed or interrupted, it can be reconstructed at any time which modules have exchanged identification data with each other and, in particular, which module had activated subscriber identity data until the channel collapsed.

In a preferred embodiment, the status data includes a count and the count is incremented or decremented as soon as the status data is received in the first subscriber identity module. For this purpose, the status data has a data field for a status change counter. On the one hand, therefore, the numbers of activations can be logged. The count can be limited to a predefined maximum value, wherein when reaching the maximum value special events can be triggered, such as the notification of the network operator and / or the subscriber.

In particular, the communication channel is cryptographically secured. Symmetric keys are used in particular for this purpose. In addition, the channel is protected by means of a message authentication code, MAC for short, so that the integrity of the status data or the identification data in each module can be verified. Manipulation of the process is thus excluded.

The basic idea of the invention furthermore includes a subscriber identity module for a terminal, comprising unique subscriber identity data for identification a subscriber in a communication network, the subscriber identity module having status data. The status data can be switched between an inactive and an active status. The subscriber identity data is enabled only from the time a status information is changed from an inactive status to an active status, thereby entitling the terminal to use services over the communication network using the subscriber identity data.

In an advantageous embodiment, the subscriber identity module has subscriber identity data for identifying the subscriber on at least two different communication networks, wherein separate status data are provided for each communication network. Thus, subscriber identity data can be activated depending on the selected communication network.

When an SMS or BIP channel is used to activate the subscriber identity data, one of the profiles is an activation subscription into which the subscriber identity module is switched as soon as the subscriber identity module subscriber identity data changes from an active status to an inactive status. Thus, the subscriber identity module is also reachable in an inactive status of the subscriber identity data for a remote mobile station for the purpose of activation and may, for example, change OTA from an inactive status to an active status.

The inventive concept also includes a system having at least two subscriber identity modules, each of the subscriber identity modules in the system having identical subscriber identity data, and each of the subscriber identity modules in the system has a unique identifier, whereby the respective subscriber identity module is uniquely identifiable in the system.

A completed status change to enable and / or disable subscriber identity data from the affected subscriber identity module is reported to a remote instance in the communication network. The remote instance is for example a server device of the network operator, which logs the status changes. Thus, the termination of the communication channel, the production of the state before receiving the status data is possible.

The invention or further embodiments and advantages of the invention will be explained in more detail with reference to figures, the figures only describe embodiments of the invention. Identical components in the figures are given the same reference numerals. The figures are not to be considered as true to scale, it can be exaggerated large or exaggerated simplified individual elements of the figures.

Figur 1

Ein System mit SIM Klonen gemäß dem Stand der Technik

Figur 2

Ein erfindungsgemäßes System zum Aktivieren von Teilneh-meridentitätsdaten

Figur 3

Ein Blockschaltbild eines erfindungsgemäßen Teilnehmeriden-titätsmoduls

Figur 4

Eine Schichtendarstellung der Programm- und Datenhierarchie in einem erfindungsgemäßen Teilnehmeridentitätsmodul

Figur 5

Eine beispielhafte Darstellung von erfindungsgemäßen Teil-nehmeridentitätsdaten

Figur 6

Ein Ausführungsbeispiel von erfindungsgemäßen Statusdaten

Figur 7a, b

Weiterbildungen der in Figur 6 gezeigten Datenfelder im Teil-nehmeridentitätsmodul

Figur 8a, b, c

Beispielhafte Ablaufdiagramme für das erfindungsgemäße Verfahren

Show it:

FIG. 1

A system with SIM clones according to the prior art

FIG. 2

An inventive system for activating subscriber identity data

FIG. 3

A block diagram of a subscriber identity module according to the invention

FIG. 4

A layer representation of the program and data hierarchy in a subscriber identity module according to the invention

FIG. 5

An exemplary representation of subscriber identity data according to the invention

FIG. 6

An embodiment of status data according to the invention

FIG. 7a, b

Trainings of in FIG. 6 displayed data fields in the subscriber identity module

FIG. 8a, b, c

Exemplary flowcharts for the method according to the invention

FIG. 1 shows a system for activating a subscriber identity module 2 in a mobile network 3 as a communication network according to the prior art. Each subscriber identity module 2 is operated by means of a terminal 1, not shown. The subscriber identity modules 2 are identical, ie SIM clones 2. All IMSI introduced into the SIM clones 2 are completely identical. The number of SIM clones 2 is not limited.

If one of the SIM clones 2 wants to log on to the mobile network 3 so that, for example, a terminal 1 not shown can use services of the mobile network 3, the SIM clone 2 makes a request to the network 3. The network 3 checks whether a SIM 2 already registered with identical IMSI. If the network 3 determines that no such IMSI has yet been registered in the network 3, it authorizes the requesting SIM 2 and sends a corresponding confirmation. However, the network 3 notes that already such an IMSI in Network 3 is registered, it does not entitle the requesting SIM 2 and sends a corresponding rejection to the SIM 2.

In FIG. 2 an embodiment of a system according to the invention is shown. The system comprises a first terminal 1a, here mobile phone 1a. The system further comprises a second terminal 1b, here mobile phone 1b. The system further comprises a third terminal 1c, here a digital picture frame 1c.

Each of the three terminals 1a, 1b, 1c includes a subscriber identity module 2a, 2b, 2c, hereinafter referred to as SIM. The SIMs 2a, 2b, 2c have identical subscriber identity data 4. Furthermore, the SIMs 2a, 2b, 2c have status data 5. Furthermore, the SIM 2a, 2b, 2c identification data 6 on. The status data 5 differ within the system according to Figure at least in that only one of the terminals 1a, 1b, 1c has subscriber identity data 4 in an active status, whereas all other terminals have subscriber identity data 4 in an inactive status. The respective status of the subscriber identity data 4 is displayed on the basis of the status data 5. In FIG. 2 the second SIM 2b has activated subscriber identity data, which is documented by an active status in the status data 5.

If a person now wants to replace the second terminal 1b with the first terminal 1a, he has hitherto had to either remove the SIM from the second terminal 1b and insert it into the first terminal 1a, whereby both terminals 1a and 1b must first be switched off. If a SIM clone according to the prior art is already contained in each terminal 1a, 1b, at least the second terminal 1b must be booked out of the network, so that the first terminal can log in. The user is on network answers and network latencies, which can sometimes take several minutes to hours. Thus, all known variants are very time-consuming, inflexible and user-friendly to a high degree.

According to the invention, a channel, for example an NFC connection, is now established between the first terminal 1a and the second terminal 1b, which is represented by the dashed arrow 9. The channel is cryptographically secured, in particular by a common symmetric key. Alternatively, the two terminals negotiate a session key valid at the time of the procedure. Now, the method according to the invention is applied by changing the status data 5 of the subscriber identity data 4 of the second subscriber identity module 2b into an inactive status. From this point on, the second terminal 1b is no longer authorized to use services of the mobile radio network 3. Subsequently, the first subscriber identity module 2a receives the status data 5 of the second subscriber identity module 2b. Subsequently, the first subscriber identity module 1a changes the status data 5 of the subscriber identity data 4 from an inactive status to an active status. From this point on, the first terminal 1a is authorized to use services of the mobile radio network 3.

In an alternative of the invention, not shown, the channel 9 is set up via a remote mobile radio, so that the communication can be done by SMS or BIP. For such an embodiment, the subscriber identity modules 2 are equipped with an activation subscription - also called provisioning subscription - into which the subscriber identity module 2 is switched if the subscriber identity data 4 of the respective subscriber identity module 2 are in an inactive status. The method can be started, for example, by means of a graphical user interface, in short GUI, so that the user can change the terminal 1 by means of fewer steps. The right to use services of the network 3 can also be transmitted from the first terminal 1a to the third terminal 1c or from the third terminal 1c to the second terminal 1b.

The method is versatile and flexible applicable to a variety of devices and everyday scenarios, the list is not all-inclusive. A subscriber can now easily switch between two terminals 1, where he used, for example, during work time a company phone as the first terminal 1a, in which all company contacts and appointments are stored. In his spare time, he uses a smart phone as the second terminal 1b, transferring the right to use the method according to the invention. In an evening appointment, the smart phone as a second device may be too unwieldy or the fear of loss due to theft too large, so he switches to an alternative device.

When using an e-book reader as a terminal, he may wish to buy another book, update a firmware of the e-book reader or perform a payment transaction, so he activates the subscriber identity 4 in the e-book reader by means of the inventive method.

For a ride on a motor vehicle, the participant uses the subscriber built-in identity module 2 fixed in the vehicle and transmits the right to use services to the terminal installed in the car via the secure channel. Thus, in addition to voice services, the vehicle can also rely on navigation services of the mobile radio network or receive communications as data services.

For example, to listen to music, the subscriber may use a digital audio device to receive digital music from an online music store. For viewing images, subscriber identity data 4 can be activated in a digital picture frame in order, for example, to transfer images from a network data memory to the picture frame. Thus, the terminal 1 may also be a multimedia terminal 1. Since only one data record of subscriber identity data 4 has to be generated for each subscriber, which is to be introduced only once in each terminal, a very simple administration is obtained. The authorization of use is simply passed over a channel between the terminals.

In an alternative embodiment, the subscriber identity modules are 2 M2M modules and introduced, for example, in terminals 1 such as machines, systems, devices or measuring units such as electricity meters, heating meters, temperature detection units, etc. to send information about the machine or the environment regarding a network 3. To transmit the information, not every terminal must now be equipped with activated subscriber identity data 4. In particular, the information can be sent by activating the subscriber identity data 4 according to the invention.

In FIG. 3 a block diagram of a subscriber identity module 2 is shown. In this case, the subscriber identity module 2 has a data interface 21. A central processing unit 22 connects the data interface 21 to a memory 23 which may be volatile (RAM) or non-volatile (ROM, EEPROM, FLASH). Both the subscriber identity data 4 and the identifier 60 are stored in a variable non-volatile memory area, for example EEPROM or Flash. Thus, the identifier 60 can be adapted for the respective system and in the case of consecutive numbering of the terminals 1, be changed or adapted accordingly. In the variable non-volatile memory area EEPROM, the status data 5 are furthermore stored, since these must be changed depending on the status of the subscriber identity data 4. In the variable non-volatile memory area EEPROM the identification data 6 are also stored. It is to distinguish between the identifier 60 of the subscriber identity module 2 and the identification data 6 of the subscriber identity modules 2, with which the subscriber identity module establishes the secure channel. The identifier thus identifies the own subscriber identity module while the identifier data identifies the other subscriber identity modules 2 in the system.

In FIG. 4 an exemplary layer representation of the program and data hierarchy in a subscriber identity module according to the invention is shown. In this case, an operating system with a general file system linked thereto is stored in the memory area 23 of the subscriber identity module, the file system being administrable via the operating system. A memory area with subscriber-specific data can also be administered via the operating system.

According to FIG. 4 it is a subscriber identity module 2, which is equipped with one or a plurality of subscriber identity profiles 7. Each subscriber identity profile 7 according to FIG. 4 includes subscriber identity data 4a, 4b, 4c, 4n, which uniquely identify and / or authenticate a subscriber to respectively different communication networks 3. The profiles a to n are individually added, activated, usable, deactivated and also erasable. An administration of the profiles 7 and the necessary data, authentication and encryption is performed by means of a subscription management client. A corresponding security level ISD secures this management of the profiles 7. The respective data are in particular loaded via an air interface, in particular over-the-air (OTA) into the respective subscriber identity module 2.

If SMS or BIP is used as channel 9, one of the profiles 7 is an activation subscription to which the subscriber identity module 2 is switched when the subscriber identity data 4 of the respective subscriber identity module 2 changes from an active status to an inactive status.

Each profile 7 in this case has individual subscriber identity data 4a, 4b, 4c, 4n, own status data 5a, 5b, 5c, 5n and possibly also identification data 6a, 6b, 6c, 6n, which uniquely identify subscriber identity modules 2 of the system. Since the identifier 60 is intended to uniquely identify only the subscriber identity module 2 in the system according to the invention, this identifier 60 can be identical in each profile 7 and / or stored outside the memory area of the profiles 7, for example in the subscriber-specific data area of the subscriber identity module 2.

With such subscriber identity modules 4, it is no longer absolutely necessary for an operator of a network 3 for the identification and authentication of a subscriber to his network to generate a new subscriber identity module 4 on the basis of a closed contract and to issue it to the subscriber in the form of a SIM card. Instead, a profile 7 is created by the network operator on the basis of the closed contract. The profile 7 is then introduced into the already introduced in the terminal 1 subscriber identity module 4 and may exist in parallel to other profiles 7. This results in that the subscriber identity module 4 is not more mechanically solvable must be introduced in a terminal 1, instead hard-wired subscriber identity modules 4, eUICCs short, be introduced in the terminal 1. This saves space in the terminal, whereby other functionalities in the terminal 1 can be realized without having to increase the size of the terminal 1. The inventive method is particularly applicable to eUICC, since a user can not move the subscriber identity module 4 from the first terminal 1a into the second terminal 1b.

According to FIG. 5 exemplary subscriber identity data 4 are listed. This subscriber identity data 4 according to FIG. 5 In particular, an indication of the authentication algorithm used by the operator of the network 3, the International Mobile Subscriber Identity (IMSI), the cryptographic authorization key used for the authentication, the parameter settings of the algorithm used, and possibly network operator-specific OTA keys to secure OTA communication allow participant-specific data, such as name, first name, ID number, date of birth, place of birth, etc .; and possibly additional network operator-specific data, for example, which services are enabled in the respective network 3 for the subscriber. This list is by no means exhaustive and may include less, more or other data in alternative examples.

In FIG. 6 example status data 5 are shown. In this case, a data field 51 is provided in the status data 5 in order to determine the number of status changes of the respective subscriber identity module 4 or of the respective profile 7 within a subscriber identity module 4 FIG. 4 to log. In this case, upon reaching a predefined value of status changes, an event within the subscriber identity module 2 can be triggered. Furthermore, a data field 52 is provided in the status data, which represents whether the subscriber identity data 4 is in an active or in an inactive status, so to speak, whether the subscriber identity module 4 is authorized to use services of the network 3 or not.

In FIGS. 7a and b are further education in FIG. 6 shown status data 5 shown with corresponding identification data 6. According to Figure 7a an additional data field 62 is provided. The data field 62 is provided in particular for the identification data 6 of the subscriber identity module 2, to which the status data 5 has been sent or is intended to send the identification data 6, that is, the accepting SIM 2.

In FIG. 7b is an alternative embodiment of in Figure 7a shown development of FIG. 6 shown. In contrast to Figure 7a two additional data fields 61, 62 are provided for identification data 6 of subscriber identity modules 2. The data field 61 is provided in particular for the identification data 6 of the subscriber identity module 2, from which the status data has been received, ie the issuing SIM 2. The data field 62 is provided in particular for the identification data 6 of the subscriber identity module 2, to which the status data 5 is sent or intends to send the identification data 6, that is, the accepting SIM 2.

It is expressly pointed out here that identification data 6 can be part of the status data 5 and thus only one data record is exchanged between the subscriber identity modules 2.

In FIG. 8a, b . c exemplary flowcharts for the method according to the invention are described. It is in all examples between the first subscriber identity module 2a and the second subscriber identity module 2b, a secure channel according to step 9 constructed. Other subscriber identity modules 2c may participate in the method, but the transmission of a right to use the services of the network 3 is always forwarded from one subscriber identity module to another subscriber identity module. In this case, the second subscriber identity module 2b is entitled to use services of the network 3, the first subscriber identity module 2a is to be authorized by activating subscriber identity data 4.

The structure of the secure channel is a prerequisite for a tamper-free and tap-free environment. Each subscriber identity module 2 involved in the procedure has a common symmetric key. In particular, a message authentication code, MAC for short, is used here. Alternatively, the participating subscriber identity modules 4 may negotiate a session key or apply asymmetric encryption.

If the sending of SMS is used as channel 9, this channel does not need to be additionally secured. For SMS, data packets secured with MAC are sent. The number of data packets varies between one and four.

According to FIG. 8a After the secure channel setup 9 has been performed, step 10 is executed by changing the status data 5 in the second subscriber identity module 2b from an active status to an inactive status. From this point on, the subscriber identity data 4 of the second subscriber identity module 2b are deactivated so that the second terminal 1b is no longer authorized to use services of the network 3. An interim authentication request of the second subscriber identity module 2b is prevented on the terminal side or rejected by the network operator. In step 10, the count X is additionally incremented in the data field 51. In step 10, the identification data 6 according to the in Figure 7a shown data field 62 is updated by the identifier 60 of the first subscriber identity module 2a, ie the accepting SIM 2a, are entered into the data field 62.

In the subsequent step 11, the status data 5 and the identification data 6 according to the updated data field 62 are transmitted from the second subscriber identity module 2b to the first subscriber identity module 2a. After receiving the status data 5 in the first subscriber identity module 2a according to step 11, the status data 5 of the first subscriber identity module 2a is changed from an inactive status to an active status. From this time, the subscriber identity data 4 of the first subscriber identity module 2a are activated, so that the first terminal 1a is authorized to use services of the network 3. In addition, in the data field 51, the count for the number of activations is incremented. If a log-on in the network 3 by means of the first terminal 1 remain unsuccessful, the transmission of the status data 5 and the identification data 6 from the second subscriber identity module is repeated, which is represented by the dashed arrow.

In FIG. 8b is one, too FIG. 8a illustrated alternative embodiment of the method according to the invention. It is - as in FIG. 8a described in step 9 - again a channel 9 between the first subscriber identity module 2a and the second subscriber identity module 2b constructed. Similar to in FIG. 8a For example, the status data 5 in the second subscriber identity module 2b is changed from an active status to an inactive status. From this point on, the subscriber identity data 4 of the second subscriber identity module 2b are deactivated so that the second terminal 1b is no longer authorized to use services of the network 3. An interim authentication request of the second subscriber identity module 2b is prevented on the terminal side or rejected by the network operator. In step 10, the count X is additionally incremented in the data field 51. In step 10, the identification data 6 is generated according to the in FIG. 7b Data field 61 and 62 are updated by entering in the data field 61 the identifier 60 of the second subscriber identity module 2b, that is the issuing SIM 2b, and in the data field 62, the identification data 6 of the first subscriber identity module 2a, ie the accepting SIM 2a, registered. In addition, in step 10, a timer is started which waits for a predefined period of time.

In the subsequent step 11, the status data 5 and the identification data 6 according to the updated data field 62 are transmitted from the second subscriber identity module 2b to the first subscriber identity module 2a. After receiving the status data 5 in the first subscriber identity module 2a according to step 11, the status data 5 of the first subscriber identity module 2a is changed from an inactive status to an active status. From this time, the subscriber identity data 4 of the first subscriber identity module 2a are activated, so that the first terminal 1a is authorized to use services of the network 3. In addition, in the data field 51, the count for the number of activations is incremented.

The first subscriber identity module 2a then sends the status data 5 and the identification data 6 as an acknowledgment to the second subscriber identity module 2b. The second subscriber identity module 2b monitors by means of the timer whether this confirmation from the first subscriber identity module 2a was obtained. If the confirmation from the first subscriber identity module 2a is not within the predefined period of time set by the timer, step 11 is repeated, as shown by the dashed arrow. The repetition can be fully automatic. Alternatively, the failure of the confirmation from the first subscriber identity module 2a is displayed to the user on a display device of the terminal 1.

In FIG. 8c is one to the FIGS. 8a and 8b illustrated alternative embodiment of the method according to the invention. It is - as in FIG. 8a described under step 9 - again a channel between the first subscriber identity module 2a and the second subscriber identity module 2b constructed. In step 10, the identification data 6 according to the in FIG. 7b Data fields 61 and 62 are updated by entering into the data field 61 the identification data 6 of the second subscriber identity module 2b, ie the issuing SIM 2b, and entering into the data field 62 the identification data 6 of the first subscriber identity module 2a, ie the accepting SIM 2a. The data fields 51 and 52 remain unchanged since neither the status nor the number of status changes are changed at the present time. In the subsequent step 11, the status data 5 and the identification data 6 according to the updated data fields 61 and 62 are transmitted from the second subscriber identity module 2b to the first subscriber identity module 2a.

In an alternative embodiment, the status data 5 are transmitted to the first subscriber identity module 2a in addition to the identification data 6. In the first subscriber identity module 2a, the data fields 61 and 62 are likewise updated in accordance with the transmitted identification data 6. The update is confirmed to the second subscriber identity module 2b.

In step 12, the second subscriber identity module 2b compares the obtained identification data 6 with the identification data entered in the data fields 61, 62. If the identification data is identical, the procedure is not aborted at this point.

Until this time, the subscriber identity data 4 of the second subscriber identity module 2b are still activated, so that the second terminal 1b is authorized to use services of the network 3. Accordingly, the subscriber identity data 4 of the first subscriber identity module 2a are deactivated so that the first terminal 1a is unauthorized to use services of the network 3. The updating of the identification data 6 both in the first and in the second subscriber identity module 2a, 2b has the purpose that, in the event of an unexpected disturbance, for example a battery failure, a malfunction of the channel, etc., it can be reconstructed at any time which subscriber identity module 2 had activated subscriber identity data 4 to whom the right to use the services of network 3 should be transferred. It is also possible that the first subscriber identity module 2a rejects activation - for whatever reason - before sending the status data 5.

After confirming the update of the identification data 6 in the first subscriber identity module 2a, the status data 5 of the second subscriber identity module 2b is changed from an active status to a status inactive (unconfirmed), which is logged in the data field 52. From this time, the subscriber identity data 4 of the second subscriber identity module 2b are deactivated, so that the second terminal 1b for the use of Services of the network 3 is no longer authorized. An interim authentication request of the second subscriber identity module 2b is prevented on the terminal side or rejected by the network operator. In addition, in the data field 51, the count for the number of activations is incremented.

In the subsequent step 11, the status data 5 are transmitted from the second subscriber identity module 2b to the first subscriber identity module 2a. The identification data 6 can also be transmitted if necessary. After receiving the status data 5 in the first subscriber identity module 2a, the status data 5 of the first subscriber identity module 2a is changed from an inactive status to an active status. From this time, the subscriber identity data 4 of the first subscriber identity module 2a are activated, so that the first terminal 1a is authorized to use services of the network 3. In addition, the count of the number of activations is registered in the data field 51. In step 13, the successful status change is acknowledged to the second subscriber identity module 2b, whereby the latter changes to the status inactive (confirmed).

The count is used to prevent so-called replay attacks, whereby the process is further secured.

This procedure ensures that communication can be resumed at any time at any time. The second subscriber identity module 2b can, in principle, transmit the identification data 6 to the first subscriber identity module 2a until it receives the confirmation in the form of the identification data 6 from the first subscriber identity module 2a according to step 11.

Should channel 9 be permanently interrupted during the execution of the method, either the operator of the network 3 can query the status data of all SIM clones 2 and reset them to a consistent state, or the subscription management client located in each subscriber identity module 2 uses the identification data 6 and the status data 5 a consistent state ago.

The status data, in particular with the count of the activation counter located in the data field 51, can be interrogated periodically by the network 3.

LIST OF REFERENCE NUMBERS

1

terminal
1a first terminal
1b second terminal
1c third terminal

2

Subscriber identity module, SIM
21 data interface
22 Central processing unit
23 volatile and non-volatile memory areas
2a First subscriber identity module
2b Second subscriber identity module
2c Third participant identity module

3

Communication network, mobile communications network

4

Subscriber identity data

4a, b, c, n

Subscriber identity data per communication network

5

state data
5a, b, c, n status data per communication network
51 Data field for status change counter
52 Data field for status inactive / active

6

identification data
61 Data field for identifying the issuing SIM
62 Data field for identifier of the accepting SIM

7

Subscriber identity profiles

8th

SIM application structure

9

Construction (secure) channel

10

Update identification data, status data, status change counter

11

Transfer of status data / identification data

12

Compare the identification data

13

Confirmation of the status change

60

(own) identifier

Claims (16)

Method for activating subscriber identity data (4) in a first subscriber identity module (2a) for uniquely identifying a subscriber in a communication network (3) with the method steps: - receiving (11) status data (5) relating to subscriber identity data (4) of a second subscriber identity module (2b) in the first subscriber identity module (2a) via a communication channel (9) between the first subscriber identity module (2a) and the second subscriber identity module (2b); - Changing a status (52) in the status data (5) in the first subscriber identity module (2a) from an inactive status to an active status, wherein from the time of the status change the subscriber identity data (4) in the first subscriber identity module (2a) are activated, whereby a first terminal (1a) is authorized to use services of the communication network (3) using the activated subscriber identity data (4). The method of claim 1, wherein the subscriber identity data (4) in the first subscriber identity module (2a) and the subscriber identity data (4) in the second subscriber identity module (4b) are identical. Method according to one of the preceding claims, wherein prior to receiving (11) the status data (5) of the second subscriber identity module (2b) in the first subscriber identity module (2a) using a second terminal (1b) for using services of the communication network (3) authorized subscriber identity data (4) in the second subscriber identity module (2b) is entitled. Method according to one of the preceding claims, wherein prior to receiving (11) the status data (4) of the second subscriber identity module (2b), a status (52) of the status data (5) of the second subscriber identity module (2b) changes from an active status to an inactive status , wherein from the time of the status change in the second subscriber identity module (2b) the subscriber identity data (4) are deactivated, whereby a second terminal (1b) for use of services of the communication network (3) is unauthorized. Method according to one of the preceding claims, wherein before receiving (11) the status data (5) of the second subscriber identity module (2b) in the second subscriber identity module (2b) identification data (6) of the first subscriber identity module (2a) containing an identifier of the first subscriber identity module (2a) be introduced. Method according to claim 5, wherein after the introduction of the identification data (6) in the second subscriber identity module (2b), the status (52) in the status data (5) of the second subscriber identity module (2b) changes from an active status to an inactive status Time of the status change in the second subscriber identity module (2b) the subscriber identity data (4) are disabled, whereby the second terminal (1b) for use of services of the communication network (3) is unauthorized. Method according to one of the preceding claims, wherein before receiving (11) the status data (5) of the second subscriber identity module (2b) in the first subscriber identity module (2a) identification data (6) of the first Subscriber identity module (2a) comprising an identifier of the second subscriber identity module (2b) and an identifier of the first subscriber identity module (2a) in the first subscriber identity module (2b) receive (11) and confirmed (13) and upon receipt of the acknowledgment the status (52) in the Status data (5) of the second subscriber identity module (2b) changes from an active status to an inactive status, wherein the subscriber identity data (4) are deactivated from the time of the status change in the second subscriber identity module (2b), whereby the second terminal (1b) uses Services of the communication network (3) is unauthorized. Method according to one of the preceding claims, wherein the change of status (52) in the status data (5) of the first subscriber identity module (2a) as confirmation (14) to the second subscriber identity module (2b) is sent. Method according to one of the preceding claims, wherein the status data (5) include a count (51) and the count (51) is incremented or decremented by the second subscriber identity module (2b) prior to sending (11) a status (52). Method according to one of the preceding claims, wherein the communication channel is cryptographically secured. Subscriber identity module (2) for a terminal (1), comprising unique subscriber identity data (4) for identifying a subscriber in a communication network (3);
characterized in that : the subscriber identity module (2) has status data (5), the status data (5) being exchangeable between an inactive and an active status, and the subscriber identity data (4) are only activated from the moment of a change of the status data (5) from an inactive status into an active status, whereby the terminal (1) uses services of the communication network (3) using the subscriber identity data (4) is entitled. Subscriber identity module (2) according to claim 11, further comprising a data field (62) for identification data (6) of at least one further subscriber identity module (2a, 2b, 2c). Subscriber identity module (2) according to claim 11 or 12, wherein the status data (5) comprise a data field (51) for a status change counter. Subscriber identity module (2) according to any one of claims 10 to 13, wherein the subscriber identity module (2) subscriber identity data (4a, 4b, 4c, 4n) for identifying the subscriber on at least two different communication networks (3), wherein for each communication network (3) separate Status data (5a, 5b, 5c, 5n) and identification data (6a, 6b, 6c, 6n) are provided. System for carrying out a method according to claims 1 to 10, wherein: the system comprises at least two subscriber identity modules (2a, 2b, 2c), each of the subscriber identity modules (2a, 2b, 2c) in the system having identical subscriber identity data (4); and - Each of the subscriber identity modules (2a, 2b, 2c) in the system has a unique identifier (60), each identifier (60) in the system is different, whereby the respective subscriber identity module (2a, 2b, 2c) is uniquely identifiable in the system. The system of claim 15, wherein a successful status change for enabling and / or disabling subscriber identity data (4) from the affected subscriber identity module (2a, 2b, 2c) to a remote entity in the communication network (3) is reported.

Images